Cyber Intelligence Insights

Key insights

• The overall threat level facing the Australian charities sector is high.
• It is increasingly likely the sector will be impacted by data theft extortion attacks against commonly used third party services, such as file transfer platforms, or managed service providers.
• The charities sector faces cyber threats from a range of actors including cyber criminals, nation-states and insiders.

• Cyber criminals have a renewed focus on targeting small to medium sized organisation.
• A key trend CyberCX is observing is the increasing scale and impact of cyber extortion attacks against third party providers.
  • Added pressure on organisations to understand, assess and manage their cyber risk in the case of a third party breach – something that can be particularly difficult for charities.
  • The risk of a third party breach is exacerbated due to the sector’s diverse operating environment and cross-sector dependencies.

• A cyber attack on an adjacent sector could have a cascading and lasting impact to Australian charities.
• Cyber extortion groups have conducted large-scale, global campaigns by exploiting vulnerabilities in file transfer services commonly used across several sectors.
  • Gateways to a wealth of data stored and transferred by organisations.
  • In June 2023, Cl0p claimed responsibility for widespread exploitation of the MOVEit secure file transfer application resulting in data theft from hundreds of organisations globally.
  • This type of incident is hard to defend against, but highlights the importance of patching and minimising the sensitive data charities hold.

• A 2023 breach of an Australian telemarketing firm providing services to over 70 Australian and New Zealand charities exposed the data of 50,000 donors.
  • Some of the stolen records dated back 15 years.
  • OAIC commenced investigation into the incident for potential breaches of Australian privacy laws.
  • The telemarketing firm ceased operations in October.